In Brief: Can Employers Monitor Personal Email Accounts that Employees Access with Company-Issued Devices?

IN BRIEF:

On Law & Practice

Fall 2018

Ayesha N. Khan · akhan@potomaclaw.com · 202.836.7136

LAW:

CAN EMPLOYERS MONITOR PERSONAL EMAIL ACCOUNTS

THAT EMPLOYEES ACCESS WITH COMPANY-ISSUED DEVICES?

Because of our dependence on cellphones, computers, and other devices, our activities and whereabouts have become trackable in ways we can't even imagine. Last term, the U.S. Supreme Court addressed a situation in which law enforcement personnel were able to track the location of several robbery suspects by tracking the whereabouts of their cellphones. See Carpenter v. United States, 138 S. Ct. 2206 (2018).

T he statute at issue in Carpenter was the Stored Communications Act (SCA), 18 U.S.C. § 2701 et seq., which speaks to surveillance of electronic information not only by law enforcement personnel but also by private individuals, including employers. So what does the statute say about employers' surveillance of employees' emails? It is clear under the statute that an employer can review emails (personal or otherwise) sent or received via the company's email account, but can an employer review the contents of a personal email account t hat has been accessed using a company-issued device?

The short answer under the statute is "no." But there is an important exception to this prohibition: Access is permitted with the consent of a party to the communication. T hus, if an employer wants discretion to review all emails sent or received with company-issued devices, it should adopt a policy to that effect, the policy should be spelled out in the employee handbook, and employees should be asked to consent to the practice in writing. It also wouldn't hurt to remind employees of the policy on an ongoing basis.

In addition, because the statute forbids monitoring that goes beyond the scope of the consent given, an employer's policy should also specify the nature of the monitoring--and then the employer must respect those parameters. For example, if a policy says that personal communications will be monitored only to determine whether they include business content, the employer should not review the full text of personal communications. Similarly, consent to "random" monitoring would not authorize an employer's practice of "reading everything." Lazette v. Kulmatycki, 949 F. Supp. 2d 748, 758 (N.D. Ohio 2013).

Employers who digress from this regime do so at some peril. In both Levin v. ImpactOffice LLC, 2017 WL 2937938, at *3-4 (D. Md. July 10, 2017), and Lazette, 949 F. Supp. 2d at 757-58, courts allowed employees to bring SCA claims against employers that accessed employees' personal email accounts without authorization, using phones the employees had returned upon their resignation. The employer in Lazette, id. at 761-63, was also on the hook for state causes of action, including invasion of privacy and intentional infliction of emotional distress.

In sum, if an employer wants to monitor all email traffic traveling on company-issued devices, it should adopt a straightforward policy to that effect, alert employees to the practice, and then do precisely what the policy says. I t's like those "speed monitored by camera" signs: If you want to monitor, you need to say so; and those being monitored will behave more judiciously than they would have otherwise, which is no bad thing.

PRACTICE:

Who(m) Cares?

We all get confused now and again about whether a sentence calls for "who" or "whom." That's largely because the technical rules can be hard to follow. Here is what we were taught:

Who should be used to refer to the subject of a sentence.

Whom should be used to refer to the object of a verb or preposition.

Rather than thinking about these rules, you can rely on an an easy trick: If you can replace the word with "he" or "she," use who; if you can replace it with "him" or "her," use whom. So here's the trick in action:

Who/whom took the cookie from the cookie jar? "She took the cookie" works well, but "her took it" doesn't work at all. So who is correct.

Who/whom did you get that cookie from? Did you get it from "he" or from "him"? Because "him" is correct, you would use the word whom.

That said, some people think "whom" sounds awkward and outdated, so they avoid the word in casual speech and writing. Others use it only in well-established phrases, such as "to whom it may concern." Still others don't use it at all. Of course, you're free to ignore the rules; just make it a conscious choice.

AYESHA N. KHAN

akhan@potomaclaw.com

Tel: (202) 836-7136

Formerly a Deputy Chief in the Appellate Section of the Civil Rights Division at the U.S. Department of Justice, Ayesha has represented a party or a friend-of-the-court in dozens of U.S. Supreme Court cases, over one hundred federal and state appeals, and scores of trial-level cases. She has extensive management and supervisory experience in the private, public, and nonprofit sectors. She is admitted to practice in Maryland and D.C., every federal circuit, and the U.S. Supreme Court. In addition to handling appeals and briefing and arguing critical motions at the trial level, she provides litigation-consulting services to advocacy organizations.

This newsletter includes general information; it is not intended to provide legal advice. You are receiving it either because you asked to be on the mailing list or we thought you would be interested in its contents . If we are wrong about that, please unsubscribe below to avoid receiving future issues.

Potomac Law Group, PLLC | PotomacLaw.com